SiYuan discloses an administrator's open documents and search terms to anonymous readers

{
  "id": "95a890b66fe76352140c6a0a9bbb5b1e3114ec497a65a83231838edb473dd616",
  "url": "https://osv.dev/vulnerability/GHSA-hgfg-j9pg-43xw",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan discloses an administrator's open documents and search terms to anonymous readers",
    "summary": "### Summary `/api/system/getConf` serves `Conf.UILayout` to publish readers after passing it through `FilterConfByPublishIgnore`, whose only function is to filter that layout. The layout is written exclusively by `setUILayout`, which is administrator-gated, so what readers receive is the administrator's own live workspace state, re-saved on every tab open, close and focus change. The filter that is supposed to protect it, `filterLayoutItemByPublishIgnore`, has four separate defects. Together they mean a single unauthenticated POST with no arguments returns the titles and identifiers of the administrator's open password-protected documents, the titles of documents in locked or closed notebooks, their recent search terms and the paths those searches were scoped to, and the paths of private assets they have open. This report concerns `FilterConfByPublishIgnore` and its layout walker. It is distinct from the previously reported `getConf` issues, which concern configuration fields surviving `HideConfSecret`'s blocklist. Restructuring the secret-masking path would not affect this, because `UILayout` is not a secret to be stripped. It is a field intended to be served and filtered. ### Details **Route and writer asymmetry.** `kernel/api/router.go:70` registers `POST /api/system/getConf` with `model.CheckAuth` only, so it is reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. The corresponding writer, `setUILayout` at `kernel/api/router.g",
    "evidence": "osv:GHSA-hgfg-j9pg-43xw",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260812083335-251596fc0de2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-hgfg-j9pg-43xw",
      "aliases": [
        "CVE-2026-72788",
        "GHSA-hgfg-j9pg-43xw",
        "GO-2026-6622"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260812083335-251596fc0de2"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hgfg-j9pg-43xw/GHSA-hgfg-j9pg-43xw.json"
          }
        }
      ],
      "modified": "2026-10-07T17:55:46.489722602Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hgfg-j9pg-43xw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72788",
        "https://github.com/siyuan-note/siyuan",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0",
        "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-uilayout-filter"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-01T14:39:32Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-72788",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 97130,
  "published_at": "2026-10-01T14:39:32+00:00"
}

{
  "id": "7738f1e538321954b1adf06f3226f02caf252049486432fa6a27ae7f542884e6",
  "url": "https://osv.dev/vulnerability/GO-2026-6622",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel",
    "summary": "SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel",
    "evidence": "osv:GO-2026-6622",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260812083335-251596fc0de2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6622",
      "aliases": [
        "CVE-2026-72788",
        "GHSA-hgfg-j9pg-43xw",
        "GO-2026-6622"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260812083335-251596fc0de2"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6622.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-07T17:45:13.719246036Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hgfg-j9pg-43xw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72788",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0",
        "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-uilayout-filter"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6622",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-72788",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97112,
  "published_at": "2026-10-07T14:09:59+00:00"
}